Tip 8: Continuations #219
Tip 8: Continuations #219
Conversation
There was a problem hiding this comment.
I have not fully understood all parts about the construction yet. Here's some comments (inline) and questions (below) I have so far.
Currently open questions:
- what about zero-knowledge when transmitting memory objects?
- is the intuition for transmitting i/o actually arithmetizable?
|
|
||
| This note describes a way to commit to the state of the virtual machine in a way that enables linking two consecutive segment-proofs. | ||
|
|
||
| At the heart of this technique lies the representation of memory as a pair of polynomials, $K(X)$ and $V(X)$. $K(X)$ is the smallest-degree polynomial that evaluates to zero in all addresses. $V(X)$ is the lowest-degree interpolant that takes the memory's value in those points. |
There was a problem hiding this comment.
that evaluates to zero in all addresses
that evaluates to zero in all used? addresses
|
|
||
| ### (c) Input and Output | ||
|
|
||
| The input evaluation arguments for proofs of consecutive segments need not be linked. What matters is that these evaluation arguments work relative to the correct subsequences of input symbols. To facilitate this, the segment claim has two additional fields relative to the whole claim: a start and stop index for reading input symbols. When read in combination with the claim for the whole computation, it is easy to select the correct substring of field elements. When merging consecutive segment proofs, it is possible that the stop index of the former equals the start index of the latter. |
There was a problem hiding this comment.
it is possible that the stop index of the former equals the start index of the latter.
it is necessary? that the stop index of the former equals the start index of the latter.
|
|
||
| To prove that the continuation polynomials at the end of one segment are equal to the continuation polynomials at the start of the next segment, assert the equality of their evaluations in a random point $\alpha$. In order to get $\alpha$ non-interactively, the prover must commit to the execution traces of both segments. | ||
|
|
||
| Specifically, let $B_A, B_B, B_C$ be the base tables of segments $A, B, C$. In order to obtain the point $\alpha$ for extending $A$, the prover must first send both the commitments to (or Merkle roots of) $B_A$ and to $B_B$. Then $\alpha \leftarrow \mathsf{H}(\mathsf{com}(B_A) \Vert \mathsf{com}(B_B))$ can be used to extend $A$. |
There was a problem hiding this comment.
In our current lingo, “extending” usually applies to base tables and means the acquisition of the extension tables. Do we want to use the same word here?
In a similar vein, do we want to call the different parts / chunks / segments of the trace “segments”, where that word is also currently used for segment polynomials?
There was a problem hiding this comment.
In our current lingo, “extending” usually applies to base tables and means the acquisition of the extension tables. Do we want to use the same word here?
I am using this exact meaning. To compute the continuation polynomials' values, you need extension columns and an
In a similar vein, do we want to call the different parts / chunks / segments of the trace “segments”, where that word is also currently used for segment polynomials?
I don't think there is any risk for confusion. Also: Risc0 is using segment in the same sense. Happy to consider alternatives though -- please suggest.
No description provided.